© 2026 vulntracker.io

CVE-2025-15454

zhanglun lettura RSS ContentRender.tsx cross site scripting

LOW

3.1

CVSS Score

Published: January 5, 2026 at 03:02 AM UTC

Updated: October 7, 2026 at 11:10 AM UTC

1 product affected across 1 vendorLettura

Using lettura by zhanglun?

Get instant alerts when new vulnerabilities affect lettura - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

LOW3.1

Exploit prediction

EPSS 0.4%

SSVC

PoC

Description

A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender.tsx of the component RSS Handler. The manipulation results in cross site scripting. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used. The patch is identified as 67213093db9923e828a6e3fd8696a998c85da2d4. It is best practice to apply a patch to resolve this issue.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Lettura · Zhanglun

60%

0.1.0 0.1.1 0.1.10 0.1.11 0.1.12 0.1.13 0.1.14 0.1.15 0.1.16 0.1.17 0.1.18 0.1.19 0.1.2 0.1.20 0.1.21 0.1.22 0.1.3 0.1.4 0.1.5 0.1.6 0.1.7 0.1.8 0.1.9

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://github.com/zhanglun/lettura/commit/67213093db9923e828a6e3fd8696a998c85da2d4

References (7)

VDB EntryTechnical Description

Source: cverecord

https://vuldb.com/?id.339487

SignaturePermissions Required

Source: cverecord

https://vuldb.com/?ctiid.339487

Third Party Advisory

Source: cverecord

https://vuldb.com/?submit.725038

Related

Source: cverecord

https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3

Exploit

Source: cverecord

https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3#proof-of-concept

Patch

Source: cverecord

https://github.com/zhanglun/lettura/commit/67213093db9923e828a6e3fd8696a998c85da2d4

Product

Source: cverecord

https://github.com/zhanglun/lettura/

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

3.1LOWVulDB

Vector?

Quick Info

StatusDEFERRED

CWE

CWE-79CWE-94

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card